CLEANUP: include: replace hand-rolled offsetof to avoid UB

The C standard specifies that it's undefined behavior to dereference
NULL (even if you use & right after). The hand-rolled offsetof idiom
&(((s*)NULL)->f) is thus technically undefined. This clutters the
output of UBSan and is simple to fix: just use the real offsetof when
it's available.

Note that there's no clear statement about this point in the spec,
only several points which together converge to this:

- From N3220, 6.5.3.4:
  A postfix expression followed by the -> operator and an identifier
  designates a member of a structure or union object. The value is
  that of the named member of the object to which the first expression
  points, and is an lvalue.

- From N3220, 6.3.2.1:
  An lvalue is an expression (with an object type other than void) that
  potentially designates an object; if an lvalue does not designate an
  object when it is evaluated, the behavior is undefined.

- From N3220, 6.5.4.4 p3:
  The unary & operator yields the address of its operand. If the
  operand has type "type", the result has type "pointer to type". If
  the operand is the result of a unary * operator, neither that operator
  nor the & operator is evaluated and the result is as if both were
  omitted, except that the constraints on the operators still apply and
  the result is not an lvalue. Similarly, if the operand is the result
  of a [] operator, neither the & operator nor the unary * that is
  implied by the [] is evaluated and the result is as if the & operator
  were removed and the [] operator were changed to a + operator.

=> In short, this is saying that C guarantees these identities:
    1. &(*p) is equivalent to p
    2. &(p[n]) is equivalent to p + n

As a consequence, &(*p) doesn't result in the evaluation of *p, only
the evaluation of p (and similar for []). There is no corresponding
special carve-out for ->.

See also: https://pvs-studio.com/en/blog/posts/cpp/0306/

After this patch, HAProxy can run without crashing after building w/
clang-19 -fsanitize=undefined -fno-sanitize=function,alignment

diff --git a/include/haproxy/compiler.h b/include/haproxy/compiler.h
index 01a1a62e7f7597ccb4f0decbed5e017125b689d1..52aee39b9f15fa3735d2c7c9582866dfd2c71cc7 100644 (file)
--- a/include/haproxy/compiler.h
+++ b/include/haproxy/compiler.h
@@ -350,7 +350,7 @@
  * <type> which has its member <name> stored at address <ptr>.
  */
 #ifndef container_of
-#define container_of(ptr, type, name) ((type *)(((char *)(ptr)) - ((long)&((type *)0)->name)))
+#define container_of(ptr, type, name) ((type *)(((char *)(ptr)) - offsetof(type, name)))
 #endif
 
 /* returns a pointer to the structure of type <type> which has its member <name>
@@ -359,7 +359,7 @@
 #ifndef container_of_safe
 #define container_of_safe(ptr, type, name) \
        ({ void *__p = (ptr); \
-               __p ? (type *)((char *)__p - ((long)&((type *)0)->name)) : (type *)0; \
+               __p ? (type *)((char *)__p - offsetof(type, name)) : (type *)0; \
        })
 #endif
 

diff --git a/include/haproxy/list.h b/include/haproxy/list.h
index ff203147c1c9977cb0b5523903d0ba8dc6c54b43..c2fcdfbc62ac68d6ff1108603219efb66dead874 100644 (file)
--- a/include/haproxy/list.h
+++ b/include/haproxy/list.h
@@ -97,7 +97,7 @@
  * since it's used only once.
  * Example: LIST_ELEM(cur_node->args.next, struct node *, args)
  */
-#define LIST_ELEM(lh, pt, el) ((pt)(((const char *)(lh)) - ((size_t)&((pt)NULL)->el)))
+#define LIST_ELEM(lh, pt, el) ((pt)(((const char *)(lh)) - offsetof(typeof(*(pt)NULL), el)))
 
 /* checks if the list head <lh> is empty or not */
 #define LIST_ISEMPTY(lh) ((lh)->n == (lh))

diff --git a/include/import/mt_list.h b/include/import/mt_list.h
index 9339d0e076dd067e8cef02dbd2c67118ce3c0011..09526eb0b06930db7f24aa71b5880941b383fddc 100644 (file)
--- a/include/import/mt_list.h
+++ b/include/import/mt_list.h
@@ -87,7 +87,7 @@ struct mt_list {
  *
  *   return MT_LIST_ELEM(cur_node->args.next, struct node *, args)
  */
-#define MT_LIST_ELEM(a, t, m) ((t)(size_t)(((size_t)(a)) - ((size_t)&((t)NULL)->m)))
+#define MT_LIST_ELEM(a, t, m) ((t)(size_t)(((size_t)(a)) - offsetof(typeof(*(t)NULL), m)))
 
 
 /* Returns a pointer of type <t> to a structure following the element which